CVE-2022-42438

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
IBM	Cloud Pak for Multicloud Management Monitoring	2.0, 2.3

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/238210VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6909427Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/238210VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6909427Patch, Vendor Advisory

Timeline

Published: Feb 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-424394.9IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Conn CVE-2022-42447.5A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stor CVE-2022-424423.3IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner CVE-2022-424439.8An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allo CVE-2022-424446.5IBM App Connect Enterprise 11.0.0.8 through 11.0.0.19 and 12.0.1.0 through 12.0.5.0 is vulnerable to a buffer overflow. A remote privileged CVE-2022-424454.9HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential p CVE-2022-424466.5Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the CVE-2022-424478.8HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a l CVE-2022-424495.4Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applica CVE-2022-42454.3A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequen CVE-2022-424505.4Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.CVE-2022-424514.4Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged us